4c9077cdc5a3dbc94a922d1731628a7a842b13ca45b3d32fda0821e0a8bc1cb2

Analysis

max time kernel
132s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 12:16

Target

5341bfed8b001e94915746c1081ffad0_NeikiAnalytics.exe
Size

79KB
MD5

5341bfed8b001e94915746c1081ffad0
SHA1

7c980a39646ef678175597afb09f1896ebc54b35
SHA256

4c9077cdc5a3dbc94a922d1731628a7a842b13ca45b3d32fda0821e0a8bc1cb2
SHA512

41c22bb546e43c8acf58da1d66691249cb38f9fcfae425baef777df9bc758972ac453c33199f3b9506a823a73f9f7d0336396485d6e2967e4925da05ec42b77f
SSDEEP

1536:zvYXfWmBA7mSJoFrOQA8AkqUhMb2nuy5wgIP0CSJ+5yVB8GMGlZ5G:zvYROd06GdqU7uy5w9WMyVN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3228	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 4120	4508	5341bfed8b001e94915746c1081ffad0_NeikiAnalytics.exe	84
PID 4508 wrote to memory of 4120	4508	5341bfed8b001e94915746c1081ffad0_NeikiAnalytics.exe	84
PID 4508 wrote to memory of 4120	4508	5341bfed8b001e94915746c1081ffad0_NeikiAnalytics.exe	84
PID 4120 wrote to memory of 3228	4120	cmd.exe	85
PID 4120 wrote to memory of 3228	4120	cmd.exe	85
PID 4120 wrote to memory of 3228	4120	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\5341bfed8b001e94915746c1081ffad0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5341bfed8b001e94915746c1081ffad0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:3228

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
79ffbccf4d78ea15ee3829a3409121a5

SHA1
bbf382201fdfd3d73b45ee268e1ab40fbc7b4915

SHA256
81152fdbeb3577bc7a923a0dd4d529041b0064914ee294aafc64503c31063350

SHA512
c9c016fc64b2d8859fbbdac3a5e4bc007d6f4ea69c2779158ad20e9418ab69b1ac91987db770aad89f4ad67ad15e8bac65913b2343bb3a1382126c99115084eb

Download Submit
memory/3228-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4508-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download